Cisco Duo Device TrustConnector Integration with
Chrome Setup GuideMay 2024

Table of Contents
Chrome Device Trust Connector in Cisco Duo Overview

03

Setup

04
Enable the Chrome Device Trust Connector in the Cisco Duo Admin Panel

04

Enabling Device Trust Connector in the Google Admin console

05

Enable the integration in the Cisco Duo Admin Panel

06

Verify scenario

07

FAQ

08

Additional Resources

11

May 2024

Chrome Device Trust Connector in Cisco Duo Overview
The Device Trust Connector is an integration

This feature is available for all licensed

between Chrome and a 3rd party IdP thateditions of Cisco Duo - Essentials,provides attestation of the device identity

Advantage and Premier.

without heavy weight integrations or agents.
Cisco Duo can use the signals to enforce
Device Trust to increase security posture in
Zero Trust architectures. Encrypted signals
are delivered to Cisco Duo via a real-time

Requirements:●

Licensed edition of Cisco Duo Essentials, Advantage or Premier●

Chrome Enterprise Core or
ChromeOS Enterprise/EduUpgrade●

Chrome browser M109 or later

HTTP header flow.
This document outlines the steps to enable
and use the Chrome Device Trust Connector
in Cisco Duo.

What platforms are Device Trust Connector supported on?
WindowsChromeOS*

Mac*ChromeOS M108 or later. Currently not available on ChromeOS Flex.

May 2024

SetupEnable the Chrome Device Trust Connector
in the Cisco Duo Admin Panel
In order to set up the connection from Chrome to Cisco Duo, you will need to create or add it to anexisting policy.
1

Log into the Duo Admin Panel and navigate to “Trusted Endpoints”.
○ If this is your first integration, click the “get started” button at the bottom of the page.

2.2

On the "Add Management Tools Integration" page, select “Chrome Device Trust Connector”
and then choose your supported OS from the dropdown menu and click the “add” button○ Note that if you support multiple OS platforms, you will need to add the integration foreach one.

1.3

In the following screen, in the section called“Configure the Chrome Device TrustConnector”, copy the values in the “URL
patterns to allow” and the “Serviceaccount” fields and save these values as
you will need them in the following section.

2.4

Enter in your domain in the “GoogleWorkspace Domains” field.

5The integration is created in the"Disabled" state.
○ You'll turn it on when you're ready toapply your Duo Trusted Endpoints
policy.
○ Turning on this integration will takeprecedence over any other active
integration.

1.

3.

May 2024

SetupEnabling Device Trust Connector
in the Google Admin console
1

Go to the Google Admin console.

2

Go to Devices > Chrome > Connectors.

3(If applicable) Accept the Connectors notification.

4

Hit the “+ New Provider” Configuration button.

5

Choose the Cisco Duo device trust connector provider and click “Set Up”.

6Provide a unique name for your configuration under “configuration name”.

7

Enter the values from Step 3 of the previous section for the URL patterns to allow and theservice account

8Hit “Add Configuration”.

Now you can apply this provider configuration to your desired organizational unit.
aChoose your desired organizational unit on the tree UI widget to the left.

bScroll down to “Device trust connectors”, use the radio buttons in this section toapply the appropriate configuration.

cHit “Save”.
May 2024

SetupEnable the integration in the Cisco Duo Admin PanelAfter creating the Chrome Device Trust Connector Trusted Endpoints integration, set the “TrustedEndpoints” policy to start checking for managed devices as users authenticate to Duo-protectedservices and applications.
●1When your trusted endpoints policy is applied to your Duo applications, return to the ChromeDevice Trust Connector Trusted Endpoints integration in the Duo Admin Panel. The "ChangeIntegration Status" section of the page shows the current integration status (disabled bydefault after creation). You can choose to either activate this integration only for members of aspecified test group or groups, or activate for all users.

●2To enable the integration to require the device to be trusted, you need to apply to a existing ornew policy. For more information about applying trusted endpoint policy to applications andgroups, check out this page (Refer to the section called “Applying the Trusted Endpoints Policyto Applications and Groups”)

May 2024

SetupVerify scenario
Assign the Cisco Duo authentication policy you just edited to an application, or confirm that it’s alreadyassigned to an app you can test.
2Log into the application.

3Confirm within the Cisco Duo Admin Panel authentication logs (Reports→Authentication Log) thatrecent successful access attempts to the protected application say “Trusted Endpoint verified byGoogle”.

May 2024

FAQ
What is Chrome Enterprise Core?

08

How are managed browsers trusted?

09

How can I clear a trusted key?

10

How do I unenroll a device?

11

What platforms are Device Trust Connector supported on?

11

What is Chrome Enterprise Core?
Chrome Enterprise Core offers a Chrome browser cloud management tool that provides theability to manage Chrome browser from a single, cloud-based admin console, across all yourMicrosoft Windows, Apple Mac, Linux, iOS, and Android devices at no additional cost. It is alsoa prerequisite for setting up and managing the integration with Cisco Duo.
●Enforce 100+ Chrome policies for all users who open Chrome browser on a managed
device. These are the same policies that can be managed with on-premise tools like
Windows Group Policy.

●Users don't have to sign in or have Google Accounts to receive policies.

●Block suspicious extensions across your organization and do other common IT tasks.

●View reports on Chrome browsers deployed across your organization, including eachbrowser's current version, installed apps and extensions, and enforced policies.

Follow these steps to roll out Chrome browser to your organization.

8May 2024

FAQ
How are managed browsers trusted?
The Chrome servers establish trust with managed browsers based on the Trust On First Use
mechanism. When it detects that the Device Trust Connector is enabled, a managed browser
will create an asymmetric key pair and upload the public key to be stored along with thebrowser’s record in the Google Admin console. That public key will subsequently be used tovalidate signatures and establish trust with regards to the origin of a payload.

Notes on Keys
Keys are only used on Windows and Mac. The ChromeOS integration instead
establishes trust using enterprise certificates stored on managed devices.
The "Clear key" operation can be useful for admins who are trying to unblock theirusers who, somehow, managed to lose their initial key.

9May 2024

FAQ
How can I clear a trusted key?
Admins with access to the Google Admin console can clear a trusted public key for aspecific browser. This troubleshooting step can prove useful if a user is experiencing accessissues which have the symptoms of a managed browser no longer having access to thetrusted key pair.
The “Clear Key” action will simply delete the public key stored on the server for thecorresponding browser. This will allow the user to restart the browser and have it upload its
current public key to establish trust once again.

Key Revocation Supported Operating Systems
WindowsMac

Clearing a Trusted Key
To clear a key, visit Chrome Enterprise Core and follow the steps:
1

Go to Devices > Chrome > Managed browsers.

2

Select the “Organizational Unit” where the browser(s) is located.

3

Select the browser with the key to be cleared.

4

Underneath the “Managed Browser” details box on the left hand side click “Configure Key”.

5

Select “CLEAR KEY”.

If the “Configure Key” is not clickable it is most likely because the key does not exist
on the server.
10May 2024

FAQ
How do I unenroll a device?
To unenroll a managed device from Chrome browser cloud management navigate
to this page for more information. To unenroll a ChromeOS device follow these steps.

Additional Resources
Chrome Enterprise Core

Chrome Device Management

Learn More at Chrome Enterprise Help CenterLearn More at Cisco Duo Help Center

11May 2024